22 votes
Accepted

PAM vs LDAP vs SSSD vs Kerberos

The sssd daemon acts as the spider in the web, controlling the login process and more. The login program communicates with the configured pam and nss modules, which in this case are provided by the ...
Johan Myréen's user avatar
15 votes
Accepted

Why does LibreOffice (at least as packaged for Debian) depend on libldap?

libreoffice-core ships /usr/lib/libreoffice/program/soffice.bin, and that is linked against libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f55a8c9e000) The package ...
Stephen Kitt's user avatar
10 votes
Accepted

apt-get doesn't find phpldapadmin in Debian 9 (Stretch)

phpldapadmin was removed from Debian Stretch in May because it was blocking the PHP 7 transition; that was fixed in August, but before it had time to migrate to Stretch, another serious bug was ...
Stephen Kitt's user avatar
8 votes
Accepted

What is the LDAP mechanism to resolve duplicated username on a LDAP client?

getpwnam(3) used to resolve abc to a number, like by login after you enter your username will query files first and find it there with uid 1000 and gid 1000 so stop there. initgroups(3) will iterate ...
Stéphane Chazelas's user avatar
7 votes
Accepted

How can I get the list of ldap users without being sudo?

Most probably the ldap configuration doesn't allow enumeration. If you know the range of user ids, you could try and get a user list by querying every possible user id: getent passwd {0..65535} ...
Stéphane Chazelas's user avatar
7 votes
Accepted

How to configure Linux to authenticate users based on Keycloak user database?

You would have to implement the following: add NSS passwd map data to Keycloak user accounts (POSIX-UID, primary POSIX-GID, etc.) implement a service pulling NSS data from Keycloak and make it ...
Michael Ströder's user avatar
7 votes

Why is LDAP with STARTTLS preferred over LDAPS

I am just wondering why is LDAP with STARTTLS is a more preferred industry standard over LDAPS. It actually isn't. Current best practice regarding STARTTLS is, according to RFC8314: In brief, this ...
Martin von Wittich's user avatar
6 votes

Home Directories and pam.d using LDAP

In Ubuntu 14.04 system-login is not present, but another file named as common-session is present. I went there and put: root@GW:~# vim /etc/pam.d/common-session # session optional ...
Mansur Ul Hasan's user avatar
6 votes

How to make ldapsearch working on SLES over tls using certificate?

Using LDAPTLS_REQCERT=never removes certificate validation of the LDAP server. This voids the security provided by TLS in the first place. Don't do this. You should fix the certificates if there is ...
returntosender404's user avatar
6 votes

Missing config file for SSSD?

Try chmod 600 /etc/sssd/sssd.conf (path to sssd.conf) and then restart sssd service (service sssd restart) sssd.conf should be run by root user with 0600 permission only. i.e your sssd.conf file ...
Rahul_Dange's user avatar
6 votes
Accepted

Samba not starting on Ubuntu Server 16.10

The issue seems to persist in 17.04 (at least for me) This worked for me: sudo systemctl disable nmbd sudo systemctl disable smbd sudo systemctl unmask samba-ad-dc sudo systemctl enable samba-ad-dc
Andrei Pop's user avatar
6 votes
Accepted

OpenLDAP vs Active Directory authentication mechanisms

OpenLDAP supports two authentication methods (simple and SASL), while SASL is the default method for ldap-utils like ldapsearch. When you are authenticating using the DN, you do a so called "simple ...
rda's user avatar
  • 941
5 votes
Accepted

getent group working, but sshd_config allowgroups does not retrieve appropriate group

uid=tupac,ou=people,dc=maytacapac,dc=inc looks wrong, as most (okay, all except this one) LDAP-provided group memberships I've seen do not include a LDAP DN, and instead just the username, so I would ...
thrig's user avatar
  • 35k
5 votes
Accepted

ldapdelete, want to remove all UID's of people OU, but preserve OU?

Sorry for the delay, but I had to install and populate an LDAP server first to test the correct procedure. As ldapdelete reads the list of objects from STDIN if there are none presented on the command ...
ridgy's user avatar
  • 831
5 votes

Ubuntu doesn't translate /home/testuser to ~

The problem is the trailing / character in the LDAP definition of $HOME: getent passwd testuser testuser:*:<uid>:<gid>:Test User:/home/testuser/:/usr/bin/bash You can demonstrate this ...
Chris Davies's user avatar
4 votes

Migrate LDAP from one machine to another

I recently had the same problem. This answer at serverfault.com worked for me. Basically, these are the steps: On the 'old' machine run the following commands to export the configuration and the data,...
ph0t0nix's user avatar
  • 1,147
4 votes
Accepted

Change default login shell to /bin/bash for ALL ldap users from LDAP server - not client

sudo nano /etc/phpldapadmin/templates/creation/posixAccount.xml The Home Directory isn't really part of the question :P, but its the only two things I modified, and I figured I'd include it! Works ...
FreeSoftwareServers's user avatar
4 votes
Accepted

What does host netgroup mean in the context of sudoHost in Sudoers LDAP Schema

A host netgroup contains a list of hosts. myhostnetgroup (server1) (server2) (server3) Refer to the manpage. If you want your netgroups in LDAP check here for some information. When you ...
MikeA's user avatar
  • 785
4 votes

How to assign LDAP user to local group "users"?

You add them to the group like you would do any user. usermod -aG users username Example. [root@red pub]# usermod -aG jabber nazu [root@red pub]# grep jabber /etc/group jabber:x:499:nazu
Sokel's user avatar
  • 1,964
4 votes

Automating Slapd Install

my debconf preseed looks a bit different, but it is for stretch: cat > /root/debconf-slapd.conf << 'EOF' slapd slapd/password1 password admin slapd slapd/internal/adminpw password admin slapd ...
rda's user avatar
  • 941
4 votes
Accepted

LDAP Search Filters using BASH

If you do: ldapsearch -h ... "'(&(this)(that="${Field1}"))'" The single quotes will be part of of the quoted string, and they will go to ldapsearch. Which doesn't expect them, giving the error. ...
ilkkachu's user avatar
  • 139k
4 votes

fix slapcat 79 character line wrap in output

A bit late maybe, but man slapcat shows: OPTIONS -o option[=value] Specify an option with a(n optional) value. Possible generic options/values are: syslog=&...
flyingscorpio's user avatar
4 votes
Accepted

How to create a list of email addresses from ldapsearch result for further processing?

After some research I've found the paste command. So adding | paste -sd ";" made it working in the way I was looking for. The final command line I'am using now is ldapsearch -h dc.example.com -p ...
U880D's user avatar
  • 1,145
4 votes
Accepted

openldap: is possible to force the starttls from a client?

You can try adding an LDAP extended operation for STARTTLS onto the URI in your client LDAP configuration file (e.g. ~/.ldaprc or /etc/ldap/ldap.conf). URI ldap://<ldap-server>/????1.3.6.1.4.1....
DericS's user avatar
  • 721
4 votes

How to automatically create local home directories for LDAP authenticated users if the home directory does not already exist?

Based on this answer I think I was putting the line in the wrong file, it should have gone in /etc/pam.d/common-session. Once I added it to the bottom of this file, my home directory was automatically ...
4 votes
Accepted

Using a shell script to parse through a CSV file and add users using the ldapadd command

ldapadd expects dn: ... from standard input. You need a "Here document": #!/bin/bash while IFS=, read -r userName firstName lastName gender dob language bloodType zodiac constellation planet ...
basin's user avatar
  • 2,061
4 votes
Accepted

How to troubleshoot a LDAP error 53 (WILL_NOT_PERFORM)?

The error you are encountering is coming from the Active Directory server itself. So the verbose error message, if it exists, is likely to be in the "Event Log" on the Active Directory ...
Philip Couling's user avatar
4 votes
Accepted

How to get list of users with a given group as primary group

I don’t think you can do any better than retrieving each member user’s information: groupinfo="$(getent group xyz)" groupinfo="${groupinfo#*:*:}" gid="${groupinfo%%:*}" ...
Stephen Kitt's user avatar
3 votes

Enabling SASL authentication mechanisms in openLDAP using OLC

I was able to enable the mechanisms using the following ldif: dn: cn=config changetype: modify add: olcSaslHost olcSaslHost: localhost - add: olcSaslSecProps olcSaslSecProps: none now my Supported ...
Andrew Meyer's user avatar
3 votes
Accepted

Files that need to be updated in /etc/pam.d/ for nss-pam-ldapd support for SSH

Typically there will be a file under /etc/pam.d/ called sshd, but it usually only contains a few lines similar to this: auth include system-remote-login account include system-remote-login ...
Josh Benson's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible